mirror of
https://github.com/photoprism/photoprism.git
synced 2026-07-18 00:59:38 +00:00
115 lines
2.7 KiB
Go
115 lines
2.7 KiB
Go
package security
|
|
|
|
import "testing"
|
|
|
|
// TestHashPath verifies deterministic hashing and path lookup behavior.
|
|
func TestHashPath(t *testing.T) {
|
|
t.Run("Deterministic", func(t *testing.T) {
|
|
const path = "/wp-login.php"
|
|
a := HashPath(path)
|
|
b := HashPath(path)
|
|
|
|
if a == 0 {
|
|
t.Fatalf("expected non-zero hash for %q", path)
|
|
}
|
|
|
|
if a != b {
|
|
t.Fatalf("expected deterministic hash for %q", path)
|
|
}
|
|
})
|
|
t.Run("IsScanPath", func(t *testing.T) {
|
|
if !IsScanPath("/wp-login.php") {
|
|
t.Fatalf("expected scanner path to be detected")
|
|
}
|
|
|
|
if !IsScanPath("/auth.json") {
|
|
t.Fatalf("expected sensitive overlay file probe to be detected")
|
|
}
|
|
|
|
if !IsScanPath("/config/options.yml") {
|
|
t.Fatalf("expected sensitive overlay path probe to be detected")
|
|
}
|
|
|
|
if !IsScanPath("/.htaccess") {
|
|
t.Fatalf("expected common config probe to be detected")
|
|
}
|
|
|
|
if !IsScanPath("/cwclass.php") {
|
|
t.Fatalf("expected web shell probe to be detected")
|
|
}
|
|
|
|
if !IsScanPath("/var/task/serverless.yml") {
|
|
t.Fatalf("expected serverless config probe to be detected")
|
|
}
|
|
|
|
for _, sensitiveSimplePath := range []string{
|
|
"/node/secrets",
|
|
"/config/portal",
|
|
"/config/certificates",
|
|
} {
|
|
if !IsScanPath(sensitiveSimplePath) {
|
|
t.Fatalf("expected sensitive simple path %q to be detected", sensitiveSimplePath)
|
|
}
|
|
}
|
|
|
|
if IsScanPath("/library") {
|
|
t.Fatalf("expected non-scanner path to be ignored")
|
|
}
|
|
|
|
for _, safePath := range []string{"/headers", "/health", "/healthz", "/hello"} {
|
|
if IsScanPath(safePath) {
|
|
t.Fatalf("expected safe path %q to be ignored", safePath)
|
|
}
|
|
}
|
|
|
|
for _, safeWellKnown := range []string{
|
|
"/.well-known/openid-configuration",
|
|
"/.well-known/jwks",
|
|
"/.well-known/jwks.json",
|
|
"/.well-known/openid-configuration/jwks",
|
|
"/.well-known/openid-configuration/jwks.json",
|
|
"/.well-known/ai-plugin.json",
|
|
"/.well-known/assetlinks.json",
|
|
"/.well-known/acme-challenge/token-abc123",
|
|
"/well-known/apple-app-site-association",
|
|
"/well-known/pki-validation/token.txt",
|
|
} {
|
|
if IsScanPath(safeWellKnown) {
|
|
t.Fatalf("expected safe .well-known path %q to be ignored", safeWellKnown)
|
|
}
|
|
}
|
|
|
|
for _, safePath := range []string{
|
|
"/home",
|
|
"/mosts",
|
|
"/html",
|
|
"/hub",
|
|
"/i/",
|
|
"/icons",
|
|
"/image",
|
|
"/img",
|
|
"/index",
|
|
"/info",
|
|
"/jobs",
|
|
"/m",
|
|
"/misc",
|
|
"/plugin",
|
|
"/i/pro-1/library/login",
|
|
"/api/ping",
|
|
"/api/v1/feature",
|
|
"/api/v1/getbaseconfig",
|
|
"/api/v1/info",
|
|
"/api/v1/instance",
|
|
"/library/login",
|
|
"/service/rest/swagger.json",
|
|
"/squid.svg",
|
|
"/video/404.mp4",
|
|
"/font/icon.eot",
|
|
"/font/open-sans/0-255.pbf",
|
|
} {
|
|
if IsScanPath(safePath) {
|
|
t.Fatalf("expected low-signal or proxy path %q to be ignored", safePath)
|
|
}
|
|
}
|
|
})
|
|
}
|